Hermes: wire the Signal adapter to the host signal-cli daemon

The hermes container reaches the host signal-cli daemon via podman's
host.containers.internal alias (127.0.0.1 in the container is not the host).
SIGNAL_ACCOUNT/SIGNAL_ALLOWED_USERS come from the git-ignored .env (the phone
number is personal, not committed). Move the data volume to a dank-owned path
(/opt is root-owned and not writable by the run user).

dankclaw/.env.example

@@ -28,3 +28,9 @@ GRAFANA_ADMIN_PASSWORD=changeme
 # 2026-08-17 redo: the llama.cpp box moved from Dankclaw to Dankserver.
 OPENAI_API_BASE_URL=http://192.168.0.235:7770/v1
 OPENAI_API_KEY=not-needed
+
+# Hermes -> Signal (signal-cli daemon on the host, port 8080)
+# E.164 number of the linked Signal account (your primary number, for Note-to-Self).
+SIGNAL_ACCOUNT=+15551234567
+# Comma-separated E.164 numbers allowed to message the agent.
+SIGNAL_ALLOWED_USERS=+15551234567

dankclaw/compose.yaml

@@ -68,10 +68,15 @@ services:
     restart: unless-stopped
     environment:
       HERMES_DATA_DIR: /data
+      # Signal adapter -> the host signal-cli daemon. The container reaches the
+      # host via podman's host alias; 127.0.0.1 inside the container is not the host.
+      SIGNAL_HTTP_URL: "http://host.containers.internal:8080"
+      SIGNAL_ACCOUNT: "${SIGNAL_ACCOUNT}"
+      SIGNAL_ALLOWED_USERS: "${SIGNAL_ALLOWED_USERS}"
     ports:
       - "8090:8090"
     volumes:
-      - /opt/hermes/data:/data
+      - /home/dank/hermes-data:/data
     healthcheck:
       test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8090/')"]
       interval: 30s